In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: Don’t leak the extension cell pointer in the bounce payload<\/p>\n
The bounce_error_event() embeds the failed event in the bounce payload
\nby pointing data.ext.ptr at it. When that event is a queued
\nvariable-length event, its own data.ext.ptr holds the address of its
\nfirst extension cell, put there by snd_seq_event_dup(). The payload
\ngoes out verbatim through snd_seq_expand_var_event(), so the address
\nreaches userspace.<\/p>\n
That is the same address commit 705dd6dcbc0e (“ALSA: seq: Clear
\nvariable event pointer on read”) removed from the event header. The
\nread path still clears it there, just above the call that expands the
\npayload.<\/p>\n
Embed a sanitised copy instead, treated exactly as snd_seq_read()
\ntreats the header. A stack copy is enough because delivery is
\nsynchronous and snd_seq_event_dup() copies before returning.<\/p>\n
An unprivileged client reaches this by setting SNDRV_SEQ_FILTER_BOUNCE,
\nqueueing a variable-length event to a port that does not exist and
\nreading the bounce back. Eight bytes on 64-bit, from its own pool.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: Don’t leak the extension cell pointer in the bounce payload<\/p>\n
The bounce_error_event() embeds the failed event in the bou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25629","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}